With patch or update on a namespaced object, set metadata.ownerReferences to point at an owner that does not exist, using a resolvable apiVersion and kind with any name and UID.
The garbage collector resolves the reference, confirms the owner is absent, and deletes the object within seconds on the next sync.
No delete permission on the object is required, and no ownership check runs unless the OwnerReferencesPermissionEnforcement admission plugin is enabled, which it is not by default.
Applies to any namespaced resource the principal can patch or update, turning patch rights into a deletion primitive for objects that delete access would otherwise gate.
Rights needed, any one set:
· any one; the primitive works on whichever resource you can patch
· any one; the primitive works on whichever resource you can patch
Note:
Distinct from CVE-2025-5187 (node self-patch to a cluster-scoped owner, patched).
This is intended behavior for namespaced objects, not a CVE, gated only by the OwnerReferencesPermissionEnforcement admission plugin, which is not enabled by default.